CVE-2024-21532

HIGH

NPM Ggit - OS Command Injection

Title source: rule

Description

All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec() Node.js child process API.

Exploits (1)

nomisec WORKING POC
by lirantal · poc
https://github.com/lirantal/CVE-2024-21532-PoC-ggit

References (3)

Scores

CVSS v3 7.3
EPSS 0.0049
EPSS Percentile 65.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Details

CWE
CWE-78
Status published
Products (2)
n/a/ggit
npm/ggit 0npm
Published Oct 08, 2024
Tracked Since Feb 18, 2026